The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a clients request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kerberos_5 | Mit | 1.12 (including) | 1.12 (including) |
| Kerberos_5 | Mit | 1.12.1 (including) | 1.12.1 (including) |
| Kerberos_5 | Mit | 1.12.2 (including) | 1.12.2 (including) |
| Kerberos_5 | Mit | 1.12.3 (including) | 1.12.3 (including) |
| Kerberos_5 | Mit | 1.13 (including) | 1.13 (including) |
| Kerberos_5 | Mit | 1.13.1 (including) | 1.13.1 (including) |
| Red Hat Enterprise Linux 7 | RedHat | krb5-0:1.13.2-10.el7 | * |
| Krb5 | Ubuntu | esm-infra-legacy/trusty | * |
| Krb5 | Ubuntu | trusty | * |
| Krb5 | Ubuntu | trusty/esm | * |
| Krb5 | Ubuntu | upstream | * |
| Krb5 | Ubuntu | utopic | * |
| Krb5 | Ubuntu | vivid | * |
| Krb5 | Ubuntu | vivid/stable-phone-overlay | * |
| Krb5 | Ubuntu | vivid/ubuntu-core | * |
References
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/74824
- http://www.ubuntu.com/usn/USN-2810-1
- https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/74824
- http://www.ubuntu.com/usn/USN-2810-1
- https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604